Security decisions you can check.
Every Prismara product follows the same engineering rules, uses the same post-quantum cryptography and is security-reviewed build by build. This page explains those rules. Where each product stands, and which builds have been independently reviewed, is on the roadmap.
The rules every product follows
Post-quantum ready from day one
Control-plane connections use TLS 1.3 with the hybrid X25519MLKEM768 key exchange. Agents and gateways refuse classical-only connections.
Servers can't forge your intent
Access grants, admin actions and policy bundles are signed by keys you hold, and the most sensitive steps need two of three custodians. A compromised server can relay them but cannot widen, re-target or replay them.
Default deny, fail closed
Nothing is reachable until a policy allows it. When a grant expires or a check fails, access stops rather than falling back to open.
Tamper-evident by construction
Every product writes an append-only, SHA-256 hash-chained audit log. Any edited or deleted entry breaks the chain and shows up in review.
Tenants separated in the database
PostgreSQL row-level security is enforced on every tenant table, so a query bug cannot return another customer's records.
Audited libraries, checked licences
Cryptography comes from audited open-source libraries. SovSec's own code is permissively licensed, and every build checks each dependency's licence. The few copyleft parts, such as Chromium's engine and the Linux base of Prismara OS, are documented exceptions with full source published.
What post-quantum means here
Post-quantum means hybrid ML-KEM-768 key exchange and ML-DSA-65 signatures alongside classical algorithms, so a break in either one alone does not expose your data.
Report a vulnerability
Email security@sovsec.com. Please don't send vulnerability reports through the contact form.
Licence exceptions
SovSec's own code is permissively licensed. These copyleft components are approved exceptions, and their full source is published with each release.
- Prismara Browser
- Chromium's Blink engine and FFmpeg (LGPL)
- Prismara OS
- openSUSE Leap 16 base packages (GPL and LGPL)
- Prismara Endpoint Security
- In-kernel eBPF programs (dual BSD and GPL)
Want SovSec to run it for you?
SovSec provides managed security, SOC and Microsoft 365 services for organisations in the UK and DACH region, and can run Prismara as part of that service.